Struct SigningKey 

pub struct SigningKey { /* private fields */ }

ed25519 signing key which can be used to produce signatures.

Implementations

impl SigningKey

Example

use ed25519_dalek::SigningKey;
use ed25519_dalek::SECRET_KEY_LENGTH;
use ed25519_dalek::SignatureError;

let secret_key_bytes: [u8; SECRET_KEY_LENGTH] = [
   157, 097, 177, 157, 239, 253, 090, 096,
   186, 132, 074, 244, 146, 236, 044, 196,
   068, 073, 197, 105, 123, 050, 105, 025,
   112, 059, 172, 003, 028, 174, 127, 096, ];

let signing_key: SigningKey = SigningKey::from_bytes(&secret_key_bytes);
assert_eq!(signing_key.to_bytes(), secret_key_bytes);

pub fn from_bytes(secret_key: &[u8; 32]) -> SigningKey

Construct a SigningKey from a SecretKey

pub fn to_bytes(&self) -> [u8; 32]

Convert this SigningKey into a SecretKey

pub fn as_bytes(&self) -> &[u8; 32]

Convert this SigningKey into a SecretKey reference

pub fn from_keypair_bytes(bytes: &[u8; 64]) -> Result<SigningKey, Error>

Construct a SigningKey from the bytes of a VerifyingKey and SecretKey.

Inputs

• bytes: an &[u8] of length KEYPAIR_LENGTH, representing the scalar for the secret key, and a compressed Edwards-Y coordinate of a point on curve25519, both as bytes. (As obtained from SigningKey::to_bytes.)

Returns

A Result whose okay value is an EdDSA SigningKey or whose error value is a SignatureError describing the error that occurred.

pub fn to_keypair_bytes(&self) -> [u8; 64]

Convert this signing key to a 64-byte keypair.

Returns

An array of bytes, [u8; KEYPAIR_LENGTH]. The first SECRET_KEY_LENGTH of bytes is the SecretKey, and the next PUBLIC_KEY_LENGTH bytes is the VerifyingKey (the same as other libraries, such as Adam Langley’s ed25519 Golang implementation). It is guaranteed that the encoded public key is the one derived from the encoded secret key.

pub fn verifying_key(&self) -> VerifyingKey

Get the VerifyingKey for this SigningKey.

pub fn with_context<'k, 'v>( &'k self, context_value: &'v [u8], ) -> Result<Context<'k, 'v, SigningKey>, Error>

Create a signing context that can be used for Ed25519ph with DigestSigner.

pub fn generate<R>(csprng: &mut R) -> SigningKey

where R: CryptoRngCore + ?Sized,

Generate an ed25519 signing key.

Example

use rand::rngs::OsRng;
use ed25519_dalek::{Signature, SigningKey};

let mut csprng = OsRng;
let signing_key: SigningKey = SigningKey::generate(&mut csprng);

Input

A CSPRNG with a fill_bytes() method, e.g. rand_os::OsRng.

pub fn sign_prehashed<MsgDigest>( &self, prehashed_message: MsgDigest, context: Option<&[u8]>, ) -> Result<Signature, Error>

where MsgDigest: Digest<OutputSize = UInt<UInt<UInt<UInt<UInt<UInt<UInt<UTerm, B1>, B0>, B0>, B0>, B0>, B0>, B0>>,

Sign a prehashed_message with this SigningKey using the Ed25519ph algorithm defined in RFC8032 §5.1.

Inputs

• prehashed_message is an instantiated hash digest with 512-bits of output which has had the message to be signed previously fed into its state.
• context is an optional context string, up to 255 bytes inclusive, which may be used to provide additional domain separation. If not set, this will default to an empty string.

Returns

An Ed25519ph Signature on the prehashed_message.

Note

The RFC only permits SHA-512 to be used for prehashing, i.e., MsgDigest = Sha512. This function technically works, and is probably safe to use, with any secure hash function with 512-bit digests, but anything outside of SHA-512 is NOT specification-compliant. We expose crate::Sha512 for user convenience.

Examples

use ed25519_dalek::Digest;
use ed25519_dalek::SigningKey;
use ed25519_dalek::Signature;
use sha2::Sha512;
use rand::rngs::OsRng;

let mut csprng = OsRng;
let signing_key: SigningKey = SigningKey::generate(&mut csprng);
let message: &[u8] = b"All I want is to pet all of the dogs.";

// Create a hash digest object which we'll feed the message into:
let mut prehashed: Sha512 = Sha512::new();

prehashed.update(message);

If you want, you can optionally pass a “context”. It is generally a good idea to choose a context and try to make it unique to your project and this specific usage of signatures.

For example, without this, if you were to convert your OpenPGP key to a Bitcoin key (just as an example, and also Don’t Ever Do That) and someone tricked you into signing an “email” which was actually a Bitcoin transaction moving all your magic internet money to their address, it’d be a valid transaction.

By adding a context, this trick becomes impossible, because the context is concatenated into the hash, which is then signed. So, going with the previous example, if your bitcoin wallet used a context of “BitcoinWalletAppTxnSigning” and OpenPGP used a context (this is likely the least of their safety problems) of “GPGsCryptoIsntConstantTimeLol”, then the signatures produced by both could never match the other, even if they signed the exact same message with the same key.

Let’s add a context for good measure (remember, you’ll want to choose your own!):

let context: &[u8] = b"Ed25519DalekSignPrehashedDoctest";

let sig: Signature = signing_key.sign_prehashed(prehashed, Some(context))?;

pub fn verify(&self, message: &[u8], signature: &Signature) -> Result<(), Error>

Verify a signature on a message with this signing key’s public key.

pub fn verify_prehashed<MsgDigest>( &self, prehashed_message: MsgDigest, context: Option<&[u8]>, signature: &Signature, ) -> Result<(), Error>

where MsgDigest: Digest<OutputSize = UInt<UInt<UInt<UInt<UInt<UInt<UInt<UTerm, B1>, B0>, B0>, B0>, B0>, B0>, B0>>,

Verify a signature on a prehashed_message using the Ed25519ph algorithm.

Inputs

• prehashed_message is an instantiated hash digest with 512-bits of output which has had the message to be signed previously fed into its state.
• context is an optional context string, up to 255 bytes inclusive, which may be used to provide additional domain separation. If not set, this will default to an empty string.
• signature is a purported Ed25519ph Signature on the prehashed_message.

Returns

Returns true if the signature was a valid signature created by this SigningKey on the prehashed_message.

Note

The RFC only permits SHA-512 to be used for prehashing, i.e., MsgDigest = Sha512. This function technically works, and is probably safe to use, with any secure hash function with 512-bit digests, but anything outside of SHA-512 is NOT specification-compliant. We expose crate::Sha512 for user convenience.

Examples

use ed25519_dalek::Digest;
use ed25519_dalek::SigningKey;
use ed25519_dalek::Signature;
use ed25519_dalek::SignatureError;
use sha2::Sha512;
use rand::rngs::OsRng;

let mut csprng = OsRng;
let signing_key: SigningKey = SigningKey::generate(&mut csprng);
let message: &[u8] = b"All I want is to pet all of the dogs.";

let mut prehashed: Sha512 = Sha512::new();
prehashed.update(message);

let context: &[u8] = b"Ed25519DalekSignPrehashedDoctest";

let sig: Signature = signing_key.sign_prehashed(prehashed, Some(context))?;

// The sha2::Sha512 struct doesn't implement Copy, so we'll have to create a new one:
let mut prehashed_again: Sha512 = Sha512::default();
prehashed_again.update(message);

let verified = signing_key.verifying_key().verify_prehashed(prehashed_again, Some(context), &sig);

assert!(verified.is_ok());

pub fn verify_strict( &self, message: &[u8], signature: &Signature, ) -> Result<(), Error>

Strictly verify a signature on a message with this signing key’s public key.

On The (Multiple) Sources of Malleability in Ed25519 Signatures

This version of verification is technically non-RFC8032 compliant. The following explains why.

1. Scalar Malleability

The authors of the RFC explicitly stated that verification of an ed25519 signature must fail if the scalar s is not properly reduced mod \ell:

To verify a signature on a message M using public key A, with F being 0 for Ed25519ctx, 1 for Ed25519ph, and if Ed25519ctx or Ed25519ph is being used, C being the context, first split the signature into two 32-octet halves. Decode the first half as a point R, and the second half as an integer S, in the range 0 <= s < L. Decode the public key A as point A’. If any of the decodings fail (including S being out of range), the signature is invalid.)

All verify_*() functions within ed25519-dalek perform this check.

2. Point malleability

The authors of the RFC added in a malleability check to step #3 in §5.1.7, for small torsion components in the R value of the signature, which is not strictly required, as they state:

Check the group equation [8][S]B = [8]R + [8][k]A’. It’s sufficient, but not required, to instead check [S]B = R + [k]A’.

History of Malleability Checks

As originally defined (cf. the “Malleability” section in the README of this repo), ed25519 signatures didn’t consider any form of malleability to be an issue. Later the scalar malleability was considered important. Still later, particularly with interests in cryptocurrency design and in unique identities (e.g. for Signal users, Tor onion services, etc.), the group element malleability became a concern.

However, libraries had already been created to conform to the original definition. One well-used library in particular even implemented the group element malleability check, but only for batch verification! Which meant that even using the same library, a single signature could verify fine individually, but suddenly, when verifying it with a bunch of other signatures, the whole batch would fail!

“Strict” Verification

This method performs both of the above signature malleability checks.

It must be done as a separate method because one doesn’t simply get to change the definition of a cryptographic primitive ten years after-the-fact with zero consideration for backwards compatibility in hardware and protocols which have it already have the older definition baked in.

Return

Returns Ok(()) if the signature is valid, and Err otherwise.

pub fn to_scalar_bytes(&self) -> [u8; 32]

Convert this signing key into a byte representation of an unreduced, unclamped Curve25519 scalar. This is NOT the same thing as self.to_scalar().to_bytes(), since to_scalar() performs a clamping step, which changes the value of the resulting scalar.

This can be used for performing X25519 Diffie-Hellman using Ed25519 keys. The bytes output by this function are a valid corresponding StaticSecret for the X25519 public key given by self.verifying_key().to_montgomery().

Note

We do NOT recommend using a signing/verifying key for encryption. Signing keys are usually long-term keys, while keys used for key exchange should rather be ephemeral. If you can help it, use a separate key for encryption.

For more information on the security of systems which use the same keys for both signing and Diffie-Hellman, see the paper On using the same key pair for Ed25519 and an X25519 based KEM.

pub fn to_scalar(&self) -> Scalar

Convert this signing key into a Curve25519 scalar. This is computed by clamping and reducing the output of Self::to_scalar_bytes.

This can be used anywhere where a Curve25519 scalar is used as a private key, e.g., in crypto_box.

Note

We do NOT recommend using a signing/verifying key for encryption. Signing keys are usually long-term keys, while keys used for key exchange should rather be ephemeral. If you can help it, use a separate key for encryption.

For more information on the security of systems which use the same keys for both signing and Diffie-Hellman, see the paper On using the same key pair for Ed25519 and an X25519 based KEM.

Trait Implementations

impl AsRef<VerifyingKey> for SigningKey

fn as_ref(&self) -> &VerifyingKey

Converts this type into a shared reference of the (usually inferred) input type.

impl Clone for SigningKey

fn clone(&self) -> SigningKey

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl ConstantTimeEq for SigningKey

fn ct_eq(&self, other: &SigningKey) -> Choice

Determine if two items are equal.

fn ct_ne(&self, other: &Self) -> Choice

Determine if two items are NOT equal.

impl Debug for SigningKey

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.

impl<D> DigestSigner<D, Signature> for SigningKey

where D: Digest<OutputSize = UInt<UInt<UInt<UInt<UInt<UInt<UInt<UTerm, B1>, B0>, B0>, B0>, B0>, B0>, B0>>,

Available on crate feature digest only.

Equivalent to SigningKey::sign_prehashed with context set to None.

Note

The RFC only permits SHA-512 to be used for prehashing. This function technically works, and is probably safe to use, with any secure hash function with 512-bit digests, but anything outside of SHA-512 is NOT specification-compliant. We expose crate::Sha512 for user convenience.

fn try_sign_digest(&self, msg_digest: D) -> Result<Signature, Error>

Attempt to sign the given prehashed message Digest, returning a digital signature on success, or an error if something went wrong.

fn sign_digest(&self, digest: D) -> S

Sign the given prehashed message Digest, returning a signature.

impl Drop for SigningKey

Available on crate feature zeroize only.

fn drop(&mut self)

Executes the destructor for this type.

impl DynSignatureAlgorithmIdentifier for SigningKey

Available on crate features alloc and pkcs8 only.

fn signature_algorithm_identifier( &self, ) -> Result<AlgorithmIdentifier<Any>, Error>

AlgorithmIdentifier for the corresponding singature system.

impl EncodePrivateKey for SigningKey

Available on crate features alloc and pkcs8 only.

fn to_pkcs8_der(&self) -> Result<SecretDocument, Error>

Serialize a SecretDocument containing a PKCS#8-encoded private key.

fn write_pkcs8_der_file(&self, path: impl AsRef<Path>) -> Result<(), Error>

Write ASN.1 DER-encoded PKCS#8 private key to the given path

impl From<&[u8; 32]> for SigningKey

fn from(secret: &[u8; 32]) -> SigningKey

Converts to this type from the input type.

impl From<&SigningKey> for PeerId

fn from(signing_key: &SigningKey) -> PeerId

Converts to this type from the input type.

impl From<&SigningKey> for VerifyingKey

fn from(signing_key: &SigningKey) -> VerifyingKey

Converts to this type from the input type.

impl From<[u8; 32]> for SigningKey

fn from(secret: [u8; 32]) -> SigningKey

Converts to this type from the input type.

impl KeypairRef for SigningKey

type VerifyingKey = VerifyingKey

Verifying key type for this keypair.

impl PartialEq for SigningKey

fn eq(&self, other: &SigningKey) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Signer<Signature> for SigningKey

fn try_sign(&self, message: &[u8]) -> Result<Signature, Error>

Sign a message with this signing key’s secret key.

fn sign(&self, msg: &[u8]) -> S

Sign the given message and return a digital signature

impl TryFrom<&[u8]> for SigningKey

type Error = Error

The type returned in the event of a conversion error.

fn try_from(bytes: &[u8]) -> Result<SigningKey, Error>

Performs the conversion.

impl TryFrom<&KeypairBytes> for SigningKey

Available on crate feature pkcs8 only.

type Error = Error

The type returned in the event of a conversion error.

fn try_from(pkcs8_key: &KeypairBytes) -> Result<SigningKey, Error>

Performs the conversion.

impl TryFrom<KeypairBytes> for SigningKey

Available on crate feature pkcs8 only.

type Error = Error

The type returned in the event of a conversion error.

fn try_from(pkcs8_key: KeypairBytes) -> Result<SigningKey, Error>

Performs the conversion.

impl TryFrom<PrivateKeyInfo<'_>> for SigningKey

Available on crate feature pkcs8 only.

type Error = Error

The type returned in the event of a conversion error.

fn try_from(private_key: PrivateKeyInfo<'_>) -> Result<SigningKey, Error>

Performs the conversion.

impl Verifier<Signature> for SigningKey

fn verify(&self, message: &[u8], signature: &Signature) -> Result<(), Error>

Verify a signature on a message with this signing key’s public key.

impl Eq for SigningKey

impl ZeroizeOnDrop for SigningKey

Available on crate feature zeroize only.